The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions explicitly direct the agent to access and 'inspect' sensitive configuration files, specifically environment files (e.g., .env, .env.local, .env.production).
Evidence: rules/exploration-depth.md mandates the inspect depth for 'Configuration files', stating they 'control behavior' and 'missing one means missing understanding'.
Evidence: references/codebase-archetypes.md instructs the agent to 'Look for' environment variables and .env files across multiple project archetypes (Next.js, Django, FastAPI, Docker).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it requires the agent to read and process the full content of all files in an untrusted codebase without safety boundaries.
Ingestion points: The agent is instructed to read every file in the project directory using read, glob, and grep tools as specified in SKILL.md and rules/exploration-depth.md.
Boundary markers: Absent. There are no instructions to use delimiters or to disregard natural language instructions found within the source code or documentation files (e.g., README.md, business logic files).
Capability inventory: The agent has access to Read, Glob, Grep, and Task (parallel sub-agents) tools as listed in the instruction_contract in SKILL.md.
Sanitization: Absent. The skill does not provide mechanisms to filter or escape content read from the files before the agent 'synthesizes' it into an artifact.

codebase-index